.product-purple li { color: #ffff; } p#ipp-innertext { color: #fff; }
Remotely collect and examine endpoint data across the enterprise to respond to security incidents, data breaches, and internal investigations. FTK Enterprise provides centralized, scalable, and defensible evidence acquisition without disrupting business operations.


Use FTK Enterprise to expose and investigate a variety of criminal and malicious activities, including data breaches, database tampering, inappropriate sharing of confidential company information, deletion of files, wiping of hard drives, or viewing of inappropriate content.
.jpg)
FTK Enterprise can deploy agents to each endpoint (including Macs), and then perform discreet agent-based remote collection to a secure, encrypted forensic container.

Full-disk collection takes up time and storage space. With FTK Enterprise, you can perform a rapid risk assessment of a suspected compromised endpoint by previewing the contents to see the endpoint’s folder structure, filter for specific file and data types, and view files of interest before performing a collection.
.jpg)
Integrate FTK Enterprise with SOAR and SIEM solutions to instantly preserve and collect endpoint evidence upon detection of an intrusion, with optional FTK Connect automation. Exterro’s seamless integration with cybersecurity platforms like Cortex XSOAR reduces risk and speeds up internal breach investigations, with 24/7 real-time evidence collection and auditable preservation capabilities.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat.
“This system reduces the burden of the staff in the FOIA Request Service Center during the collection, review and preparation of documents and materials in response to FOIA requests.”

Streamline and simplify your investigatory workflows with our patent-pending solution to the challenge of investigating mobile devices remotely. Exterro Remote Mobile Discovery empowers forensic investigators with the ability to collect data without shipping devices, wired connections, or intrusive agents installed on mobile devices.

Internal investigations begin at the moment a threat is detected, so Exterro integrates with the best innovators from cybersecurity platforms and zero trust technologies to post-incident analysis powerhouses.
FTK Enterprise has the ability to perform full-disk data collection (Windows, Mac, Linux) from both on-network and off-network endpoints, as well as from network shares and cloud data sources like Gmail, Google Drive, One Drive, O365, Microsoft Teams, SharePoint, and Exchange, and more.
Yes, FTK Enterprise uses a persistent agent that can be mass deployed to thousands of endpoints at once, including on Macs by using Jamf®. Our Agent gains full access to the disk, including all volumes and files. The FTK Agent runs as a service, and ensures a secure connection by using your organization’s X.509 certificate to protect the endpoint from becoming vulnerable. The service running does not cause the endpoint to lag and should be undetectable to the user while they’re working. The agent collects into forensically-sound evidence file formats, such as AD1, E01, L01, DMG, etc.
Yes, the agent can be installed and remain inactive until called upon, or you can deploy an agent for a specific preview or collection activity, and then uninstall it.
As described above, you will first deploy the remote agent to a Windows, Linux or Mac endpoint. You will then configure a site server to manage collection activity initiated by these remote agents located outside the local network. When you initiate a collection job from FTK Enterprise, the site server receives the request and communicates with the remote agent on the endpoint. When the endpoint is online and a connection is established, the endpoint data is encrypted and collected into an AD1 file, and then retrieved through the firewall where it can then be reviewed and analyzed in FTK Enterprise. NOTE: for off-network (i.e., off-VPN) acquisition, secure public site servers can be configured in place of private servers.
FTK Enterprise remote agents can provide visibility into endpoint data including geolocation, internet, file, and program history including uploads, downloads, and deletions. Here are some examples of what you can investigate:
- Windows Registry + System Information
- Volatile Data / Memory Analysis
- Browser history & activity
- File uploads and downloads
- Files emailed within the company or to external recipients
- Recently accessed programs, files, and network shares
- External devices that were connected to a computer
- Origination of “phishing scams” or malware
- User location based on connected network
If the endpoint goes offline during a remote collection, the collection will be paused and will automatically resume once the endpoint comes back online. If the disconnection happens during a Live Preview session, specifically, a ‘snapshot’ is created so the FTK Enterprise admin can continue to sift through file structure. The contents of the files might not be available, but the structure is there. When they find what they are looking for, the admin can send another job to the site server asking it to perform a collection when the endpoint comes back online again.
.jpg)
From multiple locations to massive employee pools and remote workers, this hospital system needed to access their entire network of endpoints to identify potential threats and eliminate them before they became full-blown incidents.

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique.
Learn about the best practices and technology that can help your organization improve its investigatory workflows.

Learn how you can conduct internal investigations and facilitate legal and regulatory compliance in enterprise environments with FTK Enterprise.

Download this product brief to learn how Exterro can transform the way you preview, collect, and analyze remote mobile device data.

Transform mobile investigations with Exterro Remote Mobile Discovery. No agents, no cables—just seamless, secure data collection. Learn more or book a demo today!
See our digital forensics and cybersecurity investigation solutions in action.